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OGC 75-3838 OGC Has Reviewed 
7 November 1975 


MEMORANDUM FOR: Freedom of Information and Privacy Acts Officers 


SUBJECT : Definition of Records to be Considered as Pertaining 
to Individuals Under Privacy Act Requests - 


1. Requests for all information should require consideration of that 
information which evidences Central Intelligence Agency interest in requester. 


2. Much information discovered during searches is not in fact informa- 
tion about individuals as contemplated by the Privacy Act, but rather is an 
incidental reference to the subject requester which is contained in a record 
pertaining to another subject and should not be considered a document respon- 
sive to the request. 


3, The comprehensive Central Intelligence Agency cross~index systems 
appear to account for these incidental references appearing during record 
searches. However, it should be stressed that references turned up as a 
result of such searches are not invariably to be considered information per- 
taining to the individual. 


4. Examples of incidental references not to be considered as informa- 
tion coming under the purview of the Freedom of Information Act are as follows: 


a. A report that A met B in front of a theatre playing a movie 
starring actress C. The fact that C's name is cross-indexed 
in a manner that makes it retrievable does not mean that 
this bit of information "pertains" to that individual as 
defined by the Privacy Act. 


b. An index card which contains the name of an individual 
but does not contain any substantive data other than file 
references is not to be considered information "pertaining" 
to an individual under the Privacy Act. 


Approved For Release 2002/01/30 : CIA-RDP84-00688R000200310009-2 


Approved@r Release 2002/01/30 : CIA-RDP84-0@}sR000200310009-2 
SUBJECT: Definition of Records to be Considered as Pertaining to Individuals 
Under Privacy Act Requests 


Distribution: 
] - Assistant to the Director 
1 - Administrative Officer 
1 - General Counsel 
1 ~ Legislative Counsel 
1 - Inspector General 
1 - Chief, Management Staff 
1 - Coordinator for Academic Relations ; 
1 - Chief, Collection Guidance and Assessments Staff 
1 - Direttor, Central Reference Service 
1-- Director, Geographic and Cartographic Research 
1 - Director of Economic Research ' 
1 - Career Management Officer . 
1 - Chief, Information and Privacy Staff 
1] - Director of Communications . 
] - Director of Finance 
1 - Director of Joint Computer Support 
1 - Director of Logistics 
1 - Director of Medical Services 
i Director of Personnel 
1 - Director of Security 
1 - Director of Training 
1 - Chief, Personnel Officer, DDS&T 
1 - Director of Technical Service 
1 - Chief, Services Staff 


1 - FIO/DDI 

1 - FIO/DDS&T 
1 - FIO/DDO 

1 ~ AI/DDA 


D/Pers Dist: 

' 1 + OP Privacy Officer 
DD/Pers/P§&C 
DD/Pers/R§&P 

- DD/Pers/SP 

C/SAS 

Policy File 


q 


j 


+ 


ee 
1 


Approved For Release 2002/01/30 : CIA-RDP84-00688R000200310009-2 


Approved For Release 2002/01/30 : CIA-RDP84-00688R000200310009-2 


TRANSMITTAL SLIP 
TO: 


DD/Pers/SP 


ROOM NO. BUILDING 


REMARKS: 


eect ao 


BUILDING” ~ 


EXTENSION 


FORM NO. REPLACES FORM 36-8 47 
1 FEB 55 241 WHICH MAY BE USED. “) 


tr 


Approved For Release 2002/01/30 : CIA-RDP84-00688R000200310009-2 


Approved @r Release 2002/01/30 : clA-RDP84-0@sR000200310009-2 


5 November 1975 


MEMORANDUM FOR: Privacy Act Systems Managers 


SUBJECT _ : Guidance on the Privacy Act 


1. Drawing on our FOIA experience, we recognize the need for . 
processing requests submitted under the Privacy Act. In the early 
going, we anticipate that a number of problems may surface that 
could have a bearing on several offices. We are, therefore, ini-— 
tiating a procedure to disseminate advisory papers, Tegal interpre- 
tations of the Act's provisions prepared by the Office of General 
Counsel, and information concerning decisions taken by the 
Information Review Committee that focus on the Privacy Act. In 
addition, as the situation warrants, we plan to use this procedure 
to provide timely guidance on the Freedom of Information Act. 


2, Attached is the first of these papers which compiles 
exemptions authorized by the Director under the Privacy Act. to | 
protect information from unauthorized disclosure. This informa- 
tion is covered in the Agency rules published in the Federal 


STATINTL * 


Register on 28 August 1975 and in the Headquarters Notice 
dated 26 September 1975. The exemptions listed in the attachment 
cite the specific provisions of the Act to assist offices in their 
review of records requested pursuant to the Privacy Act.” 


STATI 


; icy Deputy Director — 
for 
Administration 


Attachment: a/s 
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PRIVACY ACT GUIDANCE. MEMORANDUM NO. 1 
SUBJECT: CIA Privacy Act Exemptions 


The Privacy Act of 1974 provides two types of exemptions that may 
be exercised by the Head of an agency to protect information from unau- 
thorized disclosure. Under subsection (j)(1) the Director of Central 
Intelligence is authorized to exempt any system of records from certain 
provisions of the Act and, under subsection (k) the head of agency may 
exempt certain types of material from access and other provisions of 
the Act. This paper addresses the exemption authority exercised by 
the Director only as it applies to the exemption of information from 
the access and notification requirements under the Act. 


a. Subsection (j)(1) 
(qq) Information and material exempt from access: 
| (a) Polygraph records. | 


(b) Documents or segregable portions of documents in any - Loe 
system of records that consist of, pertain to,. or would other- 
wise reveal intelligence sources and methods. . 


(c) Documents or information provided by foreign, Federal, 
state or other public agencies or authorities. In those cases 
in which a record search reveals documents originated from 

_. another Federal agency, the document reference numbers, dates 

. and other document identifiers are to be referred to the Infor- 
mation and Privacy Staff (IPS) for forwarding to the originating 
agency. IPS will notify the requester in its response that 
material from another agency was identified and referred to that 
agency unless the originating agency advises IPS within a stipu-. 

~ lated period of time not to notify the requester of the existence 
of that agency's document(s). 


(d) Disclosure accounting records required by the Privacy 
Act that reveal the dissemination of information outside of CIA. 


(2) Information and material exempt from notification: 


When a determination is made by a System Manager in 
. coordination with the Chief, IPS, that confirmation of the 
existence of a record would jeopardize intelligence sources 
“and methods, the requester will be advised that there is no 
record on him pursuant to the Privacy Act, © 
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b. Subsection (k) : 
Information and material exempt from access: 


(ee (kK) (1) Properly classified in accordance with Executive 
' Order 11652, on 


-~ (k) (2) - Investigatory material compiled for law enforce-. 
ment purposes by agencies whose principal function falls out- 
side the enforcement of criminal laws. An example of material 

-in this category are records compiled in the course of an 

'- Investigation of an alleged or suspected violation of civil 

 daws, including violations of agency regulations. If an 
‘individual is denied any right, privilege, or benefit that he. 
would otherwise be eligible for as a result of the maintenance . 
of this material, he will be provided such material, except to 
the extent that disclosure of the material would reveal the | 

_ identity of a source who provided the information ta the 
Government under an express (or, prior to 27 September 1975, 

implied) promise that the identity of the source would be 

‘ held in confidence. 


ve= (k)(3) Maintained: in connection with providing protective =. 
Services to the President of the United States or other indi- 
viduals under Taw. CO wh a SL TF 


— (k)(4) Required by s statute to be maintained and used | 
solely for statistical purposes. 


-- (k)(5) Investigatory material ‘compiled solely for the pur~- 
pose of determining suitability, eligibility, or qualifications =. .° 
for Federal civilian employment, military service, Federal con-. 
tracts, or access to classified information, but only to the . ~ 
extent that the disclosure of such material would reveal the’ ~~ 
_. identity of a source who furnished information to the Govern- 
ment under an express (or, prior to 27 September 1975, implied)  .. 
- promise that the identity of the source would be held in con- 
Fidence. _ 7 


-~ (k)(6). Testing or examination ‘material used solely to. - 
- determine individual qualifications for appointment or pro- 
_ motion in the Federal service, but only if disclosure of the 
material would compromise the objectivity or. Fairness of the | 
- testing or examination process. 


le (k)(7) Evaluation material used to determine potential oo 
- for promotion in the armed services. __ oe 
“STATI NTL 


_. Deputy Director 77. ao 
LOY for on 


ee Administration - we 
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OFFICE OF MANAGEMENT AND BUDGET 
WASHINGTON, D.C, 20503 


° PATE: 5 ocT spproved > Release 2002/01/30 : CIA-RDP84-04@R000200310009-2 


REPLY FO 


atrace: FSD 


eusscer, Guidance on responding to congressional inguiries involving 
disclosure of: personal information 


- Agency Privacy Act Liaisons 


The attached memorandum to agency heads supersedes the 
Graft guidance provided to you earlier this week. 
; i 


es \\ \\ ; 7 : , 
Walter W. -Haase | 


“Deputy Associate Director 
for Information Systems 


Attachment ye 


A = 
pproved@rBsipase 2002/0413 DSCIR-RD Psa QPERVG0200310009-2 
OFFICE OF MANAGEMENT AND BUDGET : ; 


WASHINGTON, D.C. 20503 


TO THE HEADS OF EXECUTIVE DEPARTMENTS AND ESTABLISHMENTS " 


SUBJECT: Congressional, inquiries which entail access to 
personal information subject to the Privacy Act 
. 
Thig memorandum provides additional guidance to Executive 
Departments and Agencies on’ responding to congressional 
inquiries which involve access to personal information 
subject to the Privacy Act. of .1974 (5 U.S.C. 552a)- - This: 


guidance has been coordinated with the congressional 
committees with legislative jurisdiction and the principal 
agencies affected. It is intended to assure that 


implementation of the Act does not have the unintended 
effect of denying individuals the benefit of congressional 
assistance which they request. - ; 


It is recommended that each agency establish the following 
as a- routine use. for all of its systems, consistent with 
subsections (a) (7) and {e) (11) of the Acti... re 


"Disclosure may be made to a congressional office 
from the record of an individual in response to an 


inquiry from the congressional office mada at the 
request of that individual.” 


The operation of this routine use will obviate the need for 
the written consent of the constituent in every case where 
the constituent requests assistance of the Member which 
lwould entail a disclosure of information pertaining to the 
‘constituent. 


In those cases where the congressional inguicy indicates 
that the reauest is being made on behalf of a person other 
than the individual whose record is to be disclosed, the 
agency should advise the congressional office that the 
written consent of the subject of the record is required. 
The agency should not contact the subject. unless the 
congressional office requests it to do s0- 


In addition to the routine use, agencies can, of course, 
respond to many congressional reguests for assistance on 
behalf of individuals © without disclosing personal 
information which would fall within the Privacy Act, © a 


ore ho oe 
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~congres sional inquiry concerning a mi ssing Social Security 


check can be answered by the agency by stati ing the reason 


for the delay. 


Personal information can be disclosed in response to a 
congressional jnquiry without written consent or operation” 


of a routine use- 


-- if the information would be required - to be disclosed 


under the Freecom of Information Act (Subsection (b) (2)); 


~- if the Mambear requests that the ‘response go. aizectly 


<o the individual to. whom the recor pertains; 


“+= in "comoslling circumstances affecting ‘the pealth or ~ 


safety of an individual..." (Subsection (bd (8) ) ox 


~—- to either House of Congress, ox ‘to: the extent of 
matter within its Jurisdiction, any committea or 
subcommittee thereof..." (Subsection (b) (9) )- a 


The routine use recommended above and disclosures thereunder 
are, of course subject to the 30 day prior - notice, 
“requirement = "OF the Act. (Subsection -(e).(11)). . In . the. 
interim, however, it should be possible to respond to most. 


inguiries by using the provisions cited in. the previous 
paragraph. Furthermore, when the congressional inquiry 


indicates that the request is being made on the basis of a... 


written request from the individual to whom the record 
pertains, consent can be inferred even if the constituent 
letter is not provided to the agency. 


It is urged that all agency personnel who are involved in 


responding to congressional inquiries (including all field 
offices) be advised of this policy by the most expeditious 


reans available (e.qg., telephone ox cable) . Tie 


Yames T. Lynn 
Director 
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r DATE 
TRANSMITTAL SLIP 8 October 1975 


—_—— Re _—_—_ — — Oe 


TO: 2h 


. 4 
_ Director of Personnel 
ROOM NO. BUILDING 


| 5ES56 | gs 

REMARKS: 
Please make appropriate distribution 
within your Office of the attached 
OMB notice on reporting requirements 
under the Privacy Act. We will issue 
an internal memorandum on this subject 
in the near future that will provide 
guidance on in-house procedures re the 
preparation of new record system 
notices and modifications to existing 
record systems. Le 


STATINTL _ . | " 


Att 

| FROM: 

Office of DD/A 

ROOM NO. | BUILDING EXTENSION 

2542 | Hqs 6027. | 

“a NO . é @ | 
ORR DAT WwiiGh MAY BE USED. 
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DATE 


REPLY TO 
ATTN CF: 


OB, 


At etackment 


mS pon 22° APS. 


Of nooo Ratease 2020; Serer aes easy: 
‘October 2, : 1975 _ WASHIMG TON, BC, zoo 
Tso 


O48 Circular No. A-1i08 Tr ansmittal Memorandum No. 1 
Agency Liaison Revresentatives for Privacy Act Implementation 


y, 


tac hea for your information is an advance copy of 


Tre snamittal Hamorancun No. 1 to OMB Circular No. A-108 


which establishes the new system reporting requirements 


-pursuant to Section 582a (0), of the Privacy Act. 


¥ 


This Transmittal Mero will be published in the Federal | 
Pegister within the next few days. : 


Dette EF id . eA eet 


Walter W. Haase 


Deputy Associate Dixector | 
for Information systems 
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EXECUTIVE OFFICE OF THE PRESICENT 


3 oa 


CrFiCk OF MANAGEMENT AND BUOoGET 


WASHINGTON, D.C. 20503 


September 30, 1975 © '. CYRCULAR HO. A-108 . 
a -* SO Transmittal Memorandum No. 7 


TO THE HEADS OF EXECUTIVE DE2ARTMENTS AND BSTASLT SHMENTS 
SUBJECT: Responsibilities for the maintenance of records 
t 


about individua 8 by Federal agencies 


polement to OMB Circular A-108 dated 


1. Purpose, This Su 
er Ae oe 7 ‘ 
July 7, +375 provides guidance to Federal agencies regarding 


the preparation and submission of reports of their intention © 


to establish or alter systems of personal records as 
requireé by the Privacy Act of 1974 (P.L. $3-579, 5 U.S.C. 


552a(o)}. These wvrocedures supersede preliminary guidanca 
on preparing the Repert on New Systems contained in the . OMB 
Privacy Act Guidelines dated July 1, 1975. (Federal Regis ster, 
Jaly 9,.1975, p. 28377). . 

2. » Reporting requirenents. 


a. A Report on New Systems 1 must be Sus mitt ad when: 


(1) A new system of personal recor 
Privacy Act is proposed.” A new system of x 
. the new-system reporting reaquirement is one For which no 
public notice consistent with the provisions of subsection 
(e) (4) is currently published in the Federal Register. 


If a public notice for any specific system of records - is 


withdrawn, suspended, cancelled, or terminated and 
subsequently reinstated, the subject system of records shall 
be considered a new system and subject to the new system 
reporting requirement at such time that it is reinstated. 


(2) A change to a system of personal records 


subject to the Privacy Act is proposed. A new system report 
is reguired for any change to an existing system which meets 
any of the following criteria. 


(No. A-108) 
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ae 


(a) Increase or change the number cx types of 
on whom rece 


in@ividu 


als is are maintained, . Changes 
involving = number: (rather th e types) cf individuals 
about whom ords area kept need only be ,recerhed when that 
Change signiticantly alters the character and »vursose of the 
system or records, e.g., normal inereases -in nistorical 
files or obha increases in the number of records in a file: 


ry nm 


? £ 
' which can be attributed to normal growth patterns nead not 


be reported. A change resuicing from a change in the scope 
of the population covered; s.g., a system which only covered 
a portion of the work force is expanded ‘to - cover. all,’ 

required to be reported. mS mo 


wu 


(>) Expand “the type ~ or categories . of 
information maintained. For example, if an employee payroll . 
file. is axparided to include Gata on education and-.training, 
this would bea considered an expansion of the "type or 


categories of information” maintained, and would have to be 
reported, _ oO Be co ; 


a, (c) Alter the manner in which the records are _ 
(., OFganized or: the manner in which the records are tndex ed OF © 
oi ret crieved so as .to change: the mature. or -scope. of. thos 
recoras. For example, the’ combining of two or more” existing 
systems or splitting an existing system into two or more 
vi different systems such as might occur in a centralization Or oe: 
“0 1. decentralization of. organizational | responsibilities WORLG.2 os. 
“cl require @ report. a ee rs 


mo. 


oo me wea 2 a a mo . Lo . Tae oa iy a a ne _ 2 Jl Fe o 
_ .. (d) Alter the purposes for which ‘the 
information is used. For. éxample, a proposal that files 
currently used as historical military service records are. to 
bea used for’. making determinations on. elig: .ility for. 
Gisability benefits would recuire a report.” A ‘oroposal to. 
establish ox change the, "routine uses" of the system will 
not require the submission of a Report on New System if: such 
use 1s compatible with the purposes for which the system is_ 
maintained; i.e., does not, in effect, create a new purpose. 
Any new or changed "routine use" would, however, be subject 
to the requirements to give 30 days prior notice of such 
change in the Federal | Register (5 U.S.C. s52ate)(11)). 


(2) . Change the equipinent configuration (i.e., 
hardware and/or software) on which the system is operated so 
as to cxeate the potential for either greater or easier 
access. For example, the addition of a telecommunications 


(No. A~108) 
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capability which could increase the tisk of unauthorized 
‘sess would require a report. 


b. Content of the Report. Tne agenoy report on 
sroaposed new ¢ systems, or proposal to modity existing SYSteans 
shall consist of a brief narrative description, supporting 
docementation and an wsdate of the inventory of Fedaral 
as outlined below: , 


mercsonal data ‘systems 


a) "Narrative Statement ~ A brief  statemant, 
Loxtiaily not to exceed four pages in length, whica: | 


--. de ibes the purposes of the system of - 


identifies the authority under which the 
system of records is to be maintained. : 


probable or potential effect of such proposal on the privacy 
and other personal or property rights of individuals or the 
disclosure of infornation relating to such individuals and 
its effect on the preservation of the constitutional 
principle of federalism and separation of power," and 


ovides the agency’ evaluation of “tha 


ee we prov ides” ‘a brief... description. of steps: 
taken by the agency to minimize-the risk of unauthorized 
“access to the system of records including a :discussion of 
“higher. ‘or lower risk alternatives which were considered for 
meating the requivesents of the system. A more detailed 
assassment of thea isks and specific administrative, 
technical, procedural, and physical reg’ established. 
shall. be available on request. oe . | 
Tre ‘narrative _ stat ement _ should make... reference, as 9. 
appropriate, to information in the supsorti 


ng documentation 
ratner than restate such information. 


Wneare changes to computer installations, communications 
networks, or any other general changes in information 
collection, handling, storage or dissemination are made 
which affect multiple systems of records a single 
consolidated new system xeport may be submitted. In such 
cases, the narrative statement should address the overall 
privacy implications of the proposed change, identify all 
systems of records affected by the change and briefly 
describe any unigue impacts on any specific system of 


(No. A-108) 
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, u we 
records. — Supporting Gocumentation, as defined ‘in the 
subsequent paragra ohs, shall be provide for each system - OF 
racords. 


| (2) Suvporting Documentation ~ The following. shall: 
bea apovended to all naw syscam reports: ~~ a 
_ (a) An advance copy -of' the- new. or revised. 
system notice (consisten= with the provisions of 5 U.S.C. 
352aTa) (4)) which the agency proposes to publish for the nest 
altered system(s). -for proposed alterations of existing. 
scems the documentation should be srovided in the same 
a 


M as the agency proposes to publish the public notice of 
nm changes. If the agency proposes to sublish changes in 
orm of a revision to the public: notice, a copy of the 
sed notices of cevision should be provided. If the 
y plans to supersede the entire existing -notice, 
es from the currently published notice shall ha 
niighted by underlining all new or’ revised portions. 


(>) - An advance. copy of ‘any new rules . - 
changes “to published roles (consistent with the provisio Set: 
of 5 U.S.C... 552a le) (11) and (£)) which the agency proposes 

oto issue for the  new.or altered system. - If no change :to = 
. existing rules are required for the proposed new or- altered 
. system, the report ‘shall. so “state. Proposed changes to | 
“Vexisting rules. shall. be provided:-in.a manner.similar to that... 
| Gescribed: for the e system notices. aoe 2S SUEY Bae 


La 


“aay proposed rules "| 
m is to be exenoted 

: wet 

it nA the. provisions. 
rey head's ~plans---to- - 
red: systems. 15 


ra aoe ‘(e) fess advance copy “of 

Tie getting “forth the seasons why the 3Y3 
: canes 7 ~ 7 ¢ 

_ om any’ specific orov 1S10n Consisses 

an “TSC, 552a(t} ox Oy: LES the: cage 

“oe invoke any’ exemptions. or the new or alt 


a 
a wee 


(3) Update of Fede val Inven tor a “of Personal Data 
Systems - OMB in cooperation with tus dational Archives and 
Records Service is developing a perpetual inventory 6£ ail 

stems of records subject to the Act. YThe detailed plans 
or this inventory are still being developed... It is 
-anticipated, however, that agencies will be requested to 
provide a simple report to facilitate maintenance of the 
. Federal inventory. This portion of the report: on new 
systems is not in effect until such time as. further 
instructions are issued. . re - 
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“mS . 


(7) Narrative Statement. No scandard format 
mbaen established for the narrative Statement. Agencies 
anouid presant the information requested in the most concisa 
fashion possible. 


(2) Svveoerting Documentation. The format. 


Gocumentation shall, where applicabie, be consiste 
coe publication reanisements establisnad by the of 
Lhe Hederal Regist ar of. the General Services Adminis 


(3) Undate of Federal Inventory of Personal ‘Data 
Systems. Format being developed. 


a. Distribution of Report. Two copies. of each new 
systems report shail s 


oe submitted to each of the following: 


(1) Speakar of the House. - 


(2) President of the Senate. 


_ (3) The Privacy Protection Stu udy ¢ Commission. “during |. 
the pericd of its existence ‘ag set forth in Section 5(g) ‘of. 
the Privacy Act. a . 


kL 6 EES GEfice af Nenagenent._ and Budgets. 


e. Timing. A report on a. proposed new” or -altered 
system of records shall be submitted no later than the 
‘Following dates » waichever is earlier: . 


-(1)- | Shotts rofaoy: days: before- ary 
Leetion Forms. and/or instructions; 92. oo 


(2) Sixty {50) days before any public issuance of a 

Reguest for Proposal or an Invitation to Bid for computer 
and/or communications systems ox services intended to 

® support the system of records _ 


3. “Effective Date. The provisions of this Transmittal 
Memorandum are éffective upon issuance 
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S concerning  tihis -fransmittal 
assed to the information Systems 
ement and Buddac, Room’'9002,. NzO3, 
al ephone = 202 3935-4374, Ty 
eo QJ. 3 
if. Pf : , a uo oo. vs 
o: JAMES T. UENN 0.) ae 


- DIRECTOR . 


H#, incairies. ‘Taquivie 
Marorandum may “ba addzx 
Division, Office of Manag 

£ 


Washington, D. c. ‘20503, 


(Ho. A-108) 
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